Make user identifier optional for the user roles resource

Now the client can request the roles for whoever is currently logged in
without storing or explicitly requiring the user to send the identifier
through